Apple Flexing Monopolistic Muscles, Sues Indepent Researchers

[Suika]

(link to story)

How do you innovate in a market completely dominated by yourself? By stealing from someone and then crushing them with a lawsuit, of course.

 

Everybody's favorite iPhone maker, Apple, is making some serious moves in the security research field by asserting that they can and will steal from you. This has been in the news for a couple months now but is really starting to get juicy with information as Corellium starts to plead their case.

Quote

Apple in August filed a lawsuit against Corellium, a mobile device virtualization company that supports iOS, with Apple accusing Corellium of copyright infringement for replicating the operating system that runs on the iPhone and iPad.

As noted by Motherboard, Corellium today filed its response to Apple's lawsuit, accusing the Cupertino company of owing $300,000 and claiming that its software helps Apple by making it easier for security researchers to track down iOS bugs.

So in short, Corellium has managed to create a virtual iOS to make it significantly easier for security researchers to poke and prod at iOS without fear of breaking a physical device. Not only is this virtual iOS useful for researchers, it's useful for Apple themselves. Actually, it was so useful to Apple themselves, Corellium alleges that Apple actively encouraged their product, had intimate knowledge of the product, and told Corellium that it could have a big impact. Apple appeared to be quite excited by the product and wanted to buy the whole company, even. Well, about a year and a half after considering an acquisition, Apple decided to sue Corellium for infringing their IPs.

 

Quote

According to Apple, Corellium's product infringes on its copyrights by creating digital replicas of iOS, iTunes, and other apps and software. "Corellium has simply copied everything: the code, the graphical user interface, the icons - all of it, in exacting detail," reads Apple's lawsuit.
...
According to Corellium, Apple's code in its product is "fair use" and the software makes the world better by allowing security researchers to look into iOS, find flaws, and inform Apple so the bugs can be fixed.

Oh, and, not only did Apple decide to sue Corellium, Apple currently owes Corellium $300,000 for bugs that they had submitted through Apple's bug bounty program. The story so far seems to be that Corellium had submitted those bugs some time back, but figured everything was fine when they didn't get paid right away due to how friendly talks with Apple had been. It seems that Apple didn't get their way, so they just decided to sue Corellium into non-existence instead.

 

Here's a good tweet to summarize the situation.

 

(For those who can't view tweets)

@pwnallthethings

If true, this is a gross case of monopoly abuse by Apple:

 

1) Apple actively encouraged Corellium's product, cited no problems
2) Apple tried, failed to buy C
3) Apple launches invite-only competitor to C
4) Apple withholds contractual payments and tries to sue C out of existence

 

Well, if you wanted a legitimate reason to dislike Apple, here you go. This is a really abusive move from Apple to try and take absolute control of an industry and all their lawsuit has done has made them look incredibly bad.

[muito_gostoso]

iLOL

[PineyCreek]

Most organizations and businesses I know of named after fruits can be troublesome.  Except Tomato...that's a pretty good alternative router binary firmware for Broadcom-based items.

[Founders]

This is nothing new from Apple, they've been shitting in the faces of smaller companies for years. Honestly when Apple expressed interest in a buy out they should have done it, at least they would have ended up on top instead of under Apple's heal. iOS belongs to Apple, it's not opensource so they do have a right to protect it. Corellium virtualized iOS and that's where they screwed up if they did it first and asked for permission/forgiveness later.

[LIGISTX]

19 minutes ago, Ehmc130 said:

This is nothing new from Apple, they've been shitting in the faces of smaller companies for years. Honestly when Apple expressed interest in a buy out they should have done it, at least they would have ended up on top instead of under Apple's heal. iOS belongs to Apple, it's not opensource so they do have a right to protect it. Corellium virtualized iOS and that's where they screwed up if they did it first and asked for permission/forgiveness later.

This...

 

Is it useful. Yes. Is it a good thing to have for security research, probably. Is it within apples right to sue someone for stealing their IP, also yes. 

[Suika]

11 minutes ago, Ehmc130 said:

Corellium virtualized iOS and that's where they screwed up if they did it first and asked for permission/forgiveness later.

I mean... Apple was aware of what Corellium has been doing and has actively encouraged their product. I would interpret that encouragement as Apple not finding it a violation of their copyrights, and are now only suing to try and take control.

[JB25304]

7 minutes ago, Suika said:

I mean... Apple was aware of what Corellium has been doing and has actively encouraged their product. I would interpret that encouragement as Apple not finding it a violation of their copyrights, and are now only suing to try and take control.

I agree with that. If they can indeed prove that Apple knew about and even encouraged this, it would be hard to say that they suffered any damages up until the point that they delivered explicit notice that they no longer consented to let them do it.
 

Paid or not, it’s kind of hard to say that they were damaged during a time where it sounds like they were openly courting this company, knowingly let them do what they were doing, encouraged it, and may only be suing now since a deal didn’t develop. 
 

With all that being said, it’s very likely this won’t even see the courts. There’s no way this company has a war chest as deep as Apple’s. They can drag this on forever until they grind the company into dust. It’s like @Ehmc130 said, they should have sold out instead of resisting a buyout (if that is what indeed happened,) especially when their business model revolved around doing something that required them to stay in Apple’s good graces to do. 

[Bombastinator]

Iirc the problem was it was marketed to Apple as a research tool and then the company turned around and started selling it to people trying to break into their products.  Basically the developers up and up lied about usage to get access to stuff they couldn’t get otherwise.  It seems to be the major bit of the story in all other news I’ve seen about this.

 

this was somehow left out of the description.  Makes me suspicious of the description.

[Spotty]

Quote

Corellium's product creates digital replicas of iOS, iTunes, and user interface elements available on a web-based platform or a custom platform built by Corellium. It is designed to create virtual iOS devices for the purpose of running iOS, and at the recent Black Hat USA conference, Corellium emphasized that its "Apple product" is an exact copy of iOS, able to allow researchers and hackers to find and test vulnerabilities.

[...]
Apple is seeking a permanent injunction to prevent Corellium from continuing to offer a product that replicates iOS. Apple also wants Corellium to destroy all infringing materials that it's collected, and pay Apple damages, lost profits, and attorney fees.

https://www.macrumors.com/2019/08/15/apple-corellium-copyright-infringement-lawsuit/

 

I'm not a lawyer, but if Corellium are copying iOS and selling access to it then they are indeed infringing on Apple's copyrights on iOS, as well as on other Apple software such as iTunes.

 

 

The original court filing is here: Apple Inc Vs Corellium, LLC

 

Quote

This is a straightforward case of infringement of highly valuable copyrighted works. Corellium’s business is based entirely on commercializing the illegal replication of the copyrighted operating system and applications that run on Apple’s iPhone, iPad, and other Apple devices. The product Corellium offers is a “virtual” version of Apple mobile hardware products, accessible to anyone with a web browser. Specifically, Corellium serves up what it touts as a  perfect digital facsimile of a broad range of Apple’s market-leading devices—recreating with fastidious attention to detail not just the way the operating system and applications appear visually to bona fide purchasers, but also the underlying computer code. Corellium does so with no license or permission from Apple.

Quote

[...]
Instead, Corellium has simply copied everything: the code, the graphical user interface, the icons—all of it, in exacting detail

Quote

Corellium explicitly markets its product as one that allows the creation of “virtual” Apple devices. For a million dollars a year, Corellium will even deliver a “private” installation of its product to any buyer.

Quote

 The purpose of this lawsuit is not to encumber good-faith security research, but to  bring an end to Corellium’s unlawful commercialization of Apple’s valuable copyrighted works. Accordingly, Apple respectfully seeks an injunction, along with the other remedies described  below, to stop Corellium’s acts of naked copyright infringement.

 

 

What Apple is suing for:

Quote

WHEREFORE, Apple prays for the following relief:
A. A permanent injunction ordering Corellium, and its officers, directors, members, agents, servants, employees, and attorneys, and all other persons acting in concert or  participating with it, who receive actual notice of the injunction order by personal or other service, to do the following:

1. Cease all acts of direct and contributory copyright infringement related to iOS, iTunes, or any GUI Element;
2. Cease any marketing, sale, or other distribution of the Corellium Apple Product;
3. Cease all uses of the Corellium Apple Product;
4. Terminate all third-party access to the Corellium Apple Product;
5. Issue a notification to all past and present customers of the Corellium Apple Product, stating that use of the Corellium Apple Product infringes Apple’s copyrights.

B. A permanent injunction that includes all terms necessary to prevent and restrain infringement of Apple’s copyrighted works. 17 U.S.C. § 502(a).
C. An order directing Corellium to return Apple’s intellectual property, including, without limitation, all copyrighted software and works of visual art that Corellium took from Apple, as set forth in this Complaint.
D. An order impounding or destroying all infringing materials pursuant to 17 U.S.C. § 503.
E. An order awarding Apple actual damages and lost profits pursuant to 17 U.S.C. § 504(b), or in the alternative, statutory damages pursuant to 17 U.S.C. § 504(c).

 

TLDR; Corellium is copying Apple's copyrighted Software, redistributing it and selling access to it. Apple is suing them to force them to cease infringing, distributing and selling their intellectual property.

 

 

 

 

And for balance here is Corellium's recent response to the filing: https://www.documentcloud.org/documents/6532002-Corellium-Answer.html

 

Well, if Apple didn't make it clear before then they certainly did by suing them.

I'm not going to quote it all as it's quite long, but if you read their response their claim is that even though they use exact copies of Apple's software, they 'transformed' Apple's original work by offering the software in a virtual environment instead of on a physical device, and that their use of Apple's software is "fair use" as it's not a substitute for Apple's products (iPhone) as it's a virtualised client and not a physical device.

 

 

 

The claims made by Corellium that they have been working with Apple and have Apple's support are quite a strenuous connection to make.

 

Basically comes down to a personal conversation that allegedly took place with a single Apple employee in which Corellium claims an Apple employee described a different software developed and owned by a different company which was run by one of the people who later went on to be involved in Corellium as being "awesome" back in 2011.

 

(Disclaimer: There is more in this section where Corellium claims Apple has a good relationship with Corellium employees, however it has been redacted from public)

 

The other claim that Apple was "working with Corellium" is that Corellium participated in Apple's "Bug Bounty Program". Participating in a bug bounty program does not give you permission to redistribute and sell access to their licensed software.

 

 

Corellium deny all claims made by Apple that they are infringing on Apple's copyright/Intellectual property and request that the court dismisses all proceedings against them.

 

TLDR; Corellium claim they're not infringing on Apple's intellectual property because they are 'transforming' the software by offering it in a virtualised environment instead of on a physical device (phone).

Corellium also claims that Apple endorses their company and has a long-standing working relationship with them, however based on what has been presented in Corellium's response (by participating in the Bug Bounty Program, and claims that someone who later went on to work for Corellium previously had a conversation with someone who worked at apple back in or around 2011), is basically bullshit and/or heavily overstated.

 

 

Apple isn't the bad guy here. Corellium dun goofed.

[SenKa]

Thank you for doing the research @Spotty! I had a feeling we only heard half the story. 

[spartaman64]

2 hours ago, Spotty said:

 

but what they are doing is helping apple and apple recognized that at first and encouraged them to continue. its like how people making lets plays of video games are technically infringing on IP but its free advertising so companies usually dont go after them. i guess they changed their mind when corellium wanted to get paid for the bugs they found

[Spotty]

55 minutes ago, spartaman64 said:

but what they are doing is helping apple and apple recognized that at first and encouraged them to continue.

Source? Where does Apple encourage Corellium to redistribute & sell Apple's licensed software? Did the have a contract with Apple allowing them to redistribute and sell Apple's Software?
Clearly they're not encouraging it given in the court proceedings Apple are requesting Corellium cease all infringement and distribution of Apple licensed software.

 

55 minutes ago, spartaman64 said:

its like how people making lets plays of video games are technically infringing on IP but its free advertising so companies usually dont go after them.

That's not even close to being comparable. Corellium aren't uploading videos to youtube showing someone use an iPhone or iOS. They're redistributing and selling the licensed software itself. What Corellium is doing by offering a virtual iOS environment and Apple software (iOS apps) is the same as redistributing and selling emulators and ROMs for video games that allow people to play console games without buying the console or the software/games from the license holder(s).

Edited November 10, 2019 by Spotty

[mr moose]

6 minutes ago, Spotty said:

What Corellium is doing by offering a virtual iOS environment and Apple software (iOS apps) is the same as redistributing and selling emulators and ROMs for video games that allow people to play console games without buying the console or the software/games from the license holder(s).

 

Ooh that's a tricky one,  it's generally not the emulators that are the problem, it's the ROM's which are direct copies of copyright work.  Emulation is still a tricky ground in CR law so I expect this won't be a straight up case.  Fair use on the other hand doesn't appear to have been successfully used to exclude CR claims on Emulators before either.  However it is possible to emulate something using code sufficiently different enough to avoid infringement issues while doing the same job and this isn't that from apples claims.

 

Personally I don't think they are going to succeed with a fair use argument unless they can prove the end product is substantially beneficial to the public in terms of research regardless of the possible total use of CR material. It might just be too much of a stretch if we ignore the public safety of security research.

 

They will also need to prove it does not infringe on apples value or sales, which I think will be easy to prove as apple don't sell emulators for security research and you can't use this device to run your iphone ripoff. 

 

 

[spartaman64]

1 hour ago, Spotty said:

Source? Where does Apple encourage Corellium to redistribute & sell Apple's licensed software? Did the have a contract with Apple allowing them to redistribute and sell Apple's Software?
Clearly they're not encouraging it given in the court proceedings Apple are requesting Corellium cease all infringement and distribution of Apple licensed software.

 

That's not even close to being comparable. Corellium aren't uploading videos to youtube showing someone use an iPhone or iOS. They're redistributing and selling the licensed software itself. What Corellium is doing by offering a virtual iOS environment and Apple software (iOS apps) is the same as redistributing and selling emulators and ROMs for video games that allow people to play console games without buying the console or the software/games from the license holder(s).

it said in the article that apple encouraged them and apple even tried to buy them which suggests that apple thinks what they are doing is of some sort of value

[mr moose]

1 minute ago, valdyrgramr said:

Depends on the emulator design.   For example, it's not that PS2 emulator is illegal it's distribution of the PS2's bios that is illegal.

Yep, and Nintendo's SNES emulator might have exactly the same problem, however there emulators out there that don;t have the same software or bios and as such are legal (you just can't run any ROM's on them legally).

 

 

[Bombastinator]

3 minutes ago, spartaman64 said:

it said in the article that apple encouraged them and apple even tried to buy them which suggests that apple thinks what they are doing is of some sort of value

The use of present tense doesn’t make sense.  This is a thing that happened.  “Thinks they are is” vs “thought they were was”

[Master Disaster]

AFAIK Computer Code is not covered by the fair use doctrine anyway.

 

I'm sorry but in this instance it looks as though Apple are in the right and the other guys are pulling the shady move.

[mr moose]

4 minutes ago, Master Disaster said:

AFAIK Computer Code is not covered by the fair use doctrine anyway.

 

I'm sorry but in this instance it looks as though Apple are in the right and the other guys are pulling the shady move.

It can, but it comes unstuck if the work is not transformative (oracle V google).  In this case the code is not technically transformational but it is used entirely differently as it can't be implemented to do the same job as apples products do.  The biggest hurdle I think will be the amount of IOS that was copied.  The more they use of the original the harder it gets.

 

[spartaman64]

1 hour ago, valdyrgramr said:

Code theft is code theft, and Apple, not really their biggest fan, has every right to uphold and defend their copyright.   Finding bugs is one thing, but stealing the code of ios and illegal distribution is the primary reason as to why Apple is suing them.

lots of things are technically illegal like people writing fan fiction or doing lets plays of video games but companies let them happen because it benefits them. apple is only doing this to try and get out of having to pay the company for finding bugs

[mr moose]

2 minutes ago, spartaman64 said:

lots of things are technically illegal like people writing fan fiction or doing lets plays of video games but companies let them happen because it benefits them. apple is only doing this to try and get out of having to pay the company for finding bugs

That is a false equivalency.   What some companies do in this situation is not indicative of the motives nor legitimacy of what another company might do.

[Spotty]

15 minutes ago, mr moose said:

Ooh that's a tricky one,  it's generally not the emulators that are the problem, it's the ROM's which are direct copies of copyright work.  Emulation is still a tricky ground in CR law so I expect this won't be a straight up case.  Fair use on the other hand doesn't appear to have been successfully used to exclude CR claims on Emulators before either.  However it is possible to emulate something using code sufficiently different enough to avoid infringement issues while doing the same job and this isn't that from apples claims.

According to both Apple and Corellium, the version of iOS and the iOS apps (iTunes, etc) that they are offering are "identical" to the software distributed by Apple. The software has to be the same if it is being used to hunt for bugs in the software.

My guess is (and I don't really understand emulators and Virtual OS's stuff) is that Corellium developed some sort of iPhone emulator or compatibility layer that allows them to run the iOS operating system and iOS software. So maybe it's possible that distributing the software that allows the emulation needed to run iOS is fine, but it's the distribution of iOS and Apple software which is what will bite them.

 

23 minutes ago, mr moose said:

They will also need to prove it does not infringe on apples value or sales, which I think will be easy to prove as apple don't sell emulators for security research and you can't use this device to run your iphone ripoff. 

One of the marketing points used by Corellium is that their product is cheaper than buying physical devices (iPhones) from Apple to test with and that bug testers can save a lot of money. This could be argued to be depriving Apple of money since they're losing what could have otherwise been device sales.

 

Even according to Corellium's response filings they even claim that using Corellium replaces the need for companies to buy "racks" of iPhones.

 

 

 

Now, shit. Yeah if I was a bug tester that would be a much more appealing solution. Having a single virtual client instead of running physical devices sounds like it would make a huge difference to productivity and the way you work... But just because it's a good idea doesn't give them the right to redistribute licensed software without permission.

 

Whether or not they are depriving Apple of sales really weighs in when determining if Apple is entitled to financial restitution. It's not as important for determining whether or not Corellium are infringing on their intellectual property. Apple can still win and force Corellium to cease distribution of Apple software without needing to prove they suffered financial damages. All Apple needs to do is satisfy the court that Corellium is distributing the licensed software and IP without Apple's permission.

 

19 minutes ago, spartaman64 said:

it said in the article that apple encouraged them and apple even tried to buy them which suggests that apple thinks what they are doing is of some sort of value

 

From the article:

Quote

Corellium also argues that Apple has known about the company for years and has been friendly to Chris Wade, one of Corellium's founders.

Read the court documents filed by Corellium in response to Apple. The "encouragement" the article mentions relates to how Mr Wade (one of the co-founders of Corellium) was previously involved in a different company that released software back in 2011 which allegedly during a personal conversation an employee from Apple described the software as "awesome". Completely different company with different software from 8 years ago. (It's also possible that 'iEmu' only distributed the emulator and not bundled it with the licensed iOS and software, requiring anyone who used the iEmu emulator to source the software/OS themselves)

 

 

^ That has absolutely nothing to do with Corellium or the services/software they provide now in 2019. They included it as proof that Apple tried to hire them to work for their company. Being a talented software engineer has nothing to do with infringing on their intellectual property. It's ridiculous that they even included it in their response. That will be thrown out of court faster than a crying baby.

 

There's more in the court files that has been redacted, which may possibly be relating to Apple making an offer to buy Corellium LLC, however Apple making an offer to buy the company (which was not successful btw) does not in any way shape or form give that company permission to redistribute or sell Apple licensed software.

 

 

Just now, spartaman64 said:

apple is only doing this to try and get out of having to pay the company for finding bugs

That doesn't make any sense. This legal action is probably going to cost Apple just as much or possibly more than the $300,000 Corellium alleges Apple owes them for the bug bounty program, especially if it gets dragged out for a long period of time.

More likely the bugs reported by Corellium didn't qualify for the bug bounty program (Apple only paid out for certain types of bugs found, there was another story about this with someone else who found a critical security flaw in Apple devices/software but wasn't paid the bounty because it wasn't covered... But I think Apple ended up paying them anyway after public backlash) or it's possible that Corellium violated their contract with the bounty program and forfeited their right to claim bounties... Maybe by redistributing Apple licensed software without permission they breached the bounty program contract.

 

If Corellium wants to sue (or make a counter-claim?) for the $300,000 they claim to be owed by Apple then they can go right ahead. That isn't going to change the outcome in regards to infringing on Apple's IP.

[spartaman64]

1 hour ago, mr moose said:

That is a false equivalency.   What some companies do in this situation is not indicative of the motives nor legitimacy of what another company might do.

i never said that its 100% 1:1 equivalent im saying that there are examples of why companies might not want to sue people violating their IP and that protecting their IP isnt apple's motivation in this

[spartaman64]

1 hour ago, Spotty said:

 

ok but apple still tried to buy them out which means apple sees something valuable in them and maybe apple is using this lawsuit to try and force them to give their software to them

1 hour ago, valdyrgramr said:

Fan fictions, that's an iffy one, especially if it's a comedy and falls under fair use.   If I remember correctly there are companies who have gone after lets players, and one I kinda remember doing that was ATLUS.   Um, not exactly.   Apple is notorious for not wanting their stuff out there.   They also sued Louis Rossmann for having their schematics up on screen while doing repair videos.   Even if they were salty about his repair stuff and what not they weren't in the wrong over that either.   Even if they were doing this to avoid paying them over bug things you can't just steal someone's code let alone illegally distribute it.   I could argue that illegal distribution of ROMs is free advertising for Nintendo if I'm just using them as demos.   But, at the same time it's still piracy and Nintendo has every right to sue.

i never said apple doesnt have the right to sue but rather that protecting their IP might not be their motivation

[Kisai]

3 hours ago, Suika said:

I mean... Apple was aware of what Corellium has been doing and has actively encouraged their product. I would interpret that encouragement as Apple not finding it a violation of their copyrights, and are now only suing to try and take control.

The operative problem is that Corellium was not giving the bugs to Apple to fix and was selling them to the FBI, or similar spy agencies.

[spartaman64]

1 hour ago, valdyrgramr said:

It also doesn't put Apple in the wrong if the other company broke the law.

when nintendo was doing copyright claims on youtube videos of their games lots of people seemed to think nintendo was in the wrong even though lets players broke the law